[NIFI-6094] Add X-Content-Type-Options header

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.12.0
• Component/s: Security
• Labels: http-headers security
• Assignee: Nathan Gough
• Reporter: Nathan Gough
• Created: 01/Mar/19 16:06
• Updated: 21/Oct/20 17:37
• Resolved: 18/Jun/20 00:16

Description

The X-Content-Type-Options header should be added to all HTTP responses to improve security. In order for this to work correctly, all NiFi resources must accurately specify their respective Content-Type. This requires some work, as I do not believe this is currently the case for all of our resources.

Issue Links

• relates to: NIFI-2437 Enforce HSTS to require HTTPS connections if available
• links to: GitHub Pull Request #4307